Buildah Build and Push

Rootless OCI image build + push using Buildah.

Reference: loha/buildah-build@v1

Category: build

Runtime: quay.io/buildah/stable:v1.33.2 (non-root, digest-pinned)

License: Apache-2.0

When to use

Use this step when you want a rootless container image build. Buildah runs without a daemon and without root, which is the safest option in a multi-tenant cluster, so most pipelines should reach for this over docker-build.

Parameters

Parameter	Type	Default	Required	Description
IMAGE	string	—	Yes	Full image reference (registry/repo:tag)
DOCKERFILE	string	./Dockerfile	No	Path to Dockerfile relative to context
CONTEXT	string	.	No	Build context directory
TLSVERIFY	string	true	No	Enable TLS verification for registry operations
BUILD_EXTRA_ARGS	string	""	No	Additional arguments for buildah bud
PUSH_EXTRA_ARGS	string	""	No	Additional arguments for buildah push
SKIP_PUSH	string	false	No	Skip pushing the image

Workspaces

• source (required): bound from pipeline workspace source
• dockerconfig (optional): bound from pipeline workspace docker-credentials

Results

Result	Description
IMAGE_DIGEST	Digest of the built and pushed image
IMAGE_URL	Full URL of the pushed image

How it works

Runs the quay.io/buildah/stable image with the BUILD_ROOTLESS security context (non-root, SETUID/SETGID added for user-namespace mapping). Builds the image with buildah bud and pushes with buildah push. Registry credentials come from the dockerconfig workspace, which Loha populates automatically from the registries you configure under Settings → Registries. You do not create or bind it yourself. If no credential matches the target registry, only a public (anonymous) push can succeed.

Examples

Build and push to Harbor

steps:
  - name: build
    uses: loha/buildah-build@v1
    with:
      IMAGE: 'registry.example.com/my-org/my-app:${COMMIT_SHA}'
      DOCKERFILE: './Dockerfile'
      CONTEXT: '.'

Validation-only build (no push)

Useful in PR pipelines to make sure the Dockerfile still builds without polluting the registry.

steps:
  - name: validate-image
    uses: loha/buildah-build@v1
    with:
      IMAGE: 'registry.example.com/my-org/my-app:pr-${PR_NUMBER}'
      SKIP_PUSH: 'true'

Troubleshooting

Problem: Push fails with 401 Unauthorized against a private registry.

Solution: Add the target registry under Settings → Registries with a username and a push-scoped access token; Loha supplies it to the build automatically. For Harbor, use a robot account with push permission on the target project.

---

Problem: Build fails with "operation not permitted" on overlayfs.

Solution: This is a rootless-mode kernel restriction on some hosts. Pass BUILD_EXTRA_ARGS: "--storage-driver=vfs" to fall back to the slower but more compatible vfs driver.